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AMENDMENTS TO THE CLAIMS 

What Is Claimed Is: 
1-41. Cancelled 

42. (New) A computer-based method for identifying a situation representing risk to a 
brokerage or its investors, comprising: 

receiving, on a periodic basis, data from at least one source, wherein the received data 
comprises a plurality of transactions relating to securities trading and a plurality of entities 
involved in securities trading, wherein the plurality of transactions and the plurality of entities 
are not predetermined to be related; 

accessing a scenario library to identify a detection algorithm for identifying a behavior of 
interest indicative of a risk to a brokerage or its investors; 

applying the detection algorithm to identify common elements between a plurality of the 
transactions and a plurality of the entities in the received data to determine whether the common 
elements are collectively indicative of the behavior of interest; 

determining, by a computing device, whether one or more relationships exist among the 
transactions and the entities that exhibit the common element; and 

if so, generating an alert informing a user of the related transactions and entities that 
exhibit the common elements. 

43. (New) The method of claim 42, wherein the determining whether one or more 
relationships exist comprises performing one or more of the following on the plurality of 
transactions and the plurality of entities: 
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sequence matching to identify sequences in one or more transactions and to relate the 
identified sequences to one or more of the entities in the received data; 

link analysis to establish connections between one or more transactions and entities in the 
received data; 

rule-based analysis to identify at least one of the transactions and entities based on rules 
specifying parameters and thresholds; 

outlier detection analysis to identify at least one of the transactions and entities outside of 
a defined statistical range; 

decision tree analysis; and 

detection processing using neural networks. 

44. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises holding concentrated positions in a single security; and 
the received data comprises market value of a concentrated position and total cash and 
security value. 

45. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises holding a concentrated position in low-priced 
securities; and 
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the received data comprises low-priced equities balance and total cash and security value. 

46. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises abusing auto-execution systems; and 

the received data comprises information associated with a plurality of orders. 

47. (New) The method of claim 46, further comprising generating an alert if one or more of 
the following conditions are met: 

each order is on a same side of a market; 

a total time span between orders is less than a threshold; 

a quantity of each order is less than an auto-execution threshold; 

a total quantity of orders exceeds the auto-execution threshold; 

a plurality of the orders originate from a same account; 

a plurality of the orders originate from a plurality of accounts associated with a same 
household; and 

the orders are entered during regular trading hours. 

48. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises marking the close; and 
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the received data comprises order time, holdings by others in a household and margin 
maintenance percentage. 

49. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises making improper short sales; and 
the received data comprises securities sold by an account holder, securities held long by 
an account holder and securities purchased by an account holder. 

50. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises making cross-trades away from the market; and 
the received data comprises information associated with a plurality of executions. 

5 1 . (New) The method of claim 50, further comprising generating an alert if a plurality of 
executions: 

occur during extended trading hours; 
involve a same security; 
have a same execution price; 
have a same execution date and time; 
are on opposite sides of a market. 
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52. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises encouraging orders by marking them as unsolicited; 

and 

the received data comprises a number of unsolicited orders and a number of solicited 

orders. 

53. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises encouraging short-term holding; and 

the received data comprises buy orders, sell orders and indication of solicitation. 

54. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more securities 
representatives; 

the behavior of interest comprises soliciting orders but marking them as unsolicited; and 
the received data comprises solicitation attempts and unsolicited orders. 
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55. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more securities 
representatives; 

the behavior of interest comprises shadowing a customer's account; and 
the received data comprises time between trades in a security. 

56. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more brokerage order-takers or 
employees; 

the behavior of interest comprises front-running; and 

the received data comprises employee account activity and employee-linked account 
activity. 

57. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more brokerage employees; 
the behavior of interest comprises trading on insider information; and 
the received data comprises closing prices and trades in an account associated with an 
employee. 

58. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more brokerage employees; 
the behavior of interest comprises making large deposits; and 

the received data comprises employee deposit amounts and employee account net worth. 
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59. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 

brokerage and securities representatives; 

the behavior of interest comprises rapid switching of mutual funds; and 

the received data comprises fund purchase date, mutual fund sale date and solicitation 

records. 

60. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more investment advisors; 
the behavior of interest comprises disproportionate allocation of IPO shares; and 
the received data comprises IPO initial trading price, IPO closing price and subaccount 
IPO allocation. 

61. (New) The method of claim 42, wherein 

one or more of the plurality of transactions involve an investment advisors; 

the behavior of interest comprises unfair allocation of block trades to subaccounts of the 
investment advisor; and 

the received data comprises block trade purchase price, block trade allocation and 
security price at time of allocation. 
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(New) The method of claim 42, wherein 

one or more of the plurality of transactions involve an investment advisor; 
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the behavior of interest comprises maintenance of concentrated positions in a subaccount 
of the investment advisor; and 

the received data comprises a value of individual equities within the subaccount, a value 
of the subaccount and a total number of subaccounts managed by the advisor. 

63. (New) The method of claim 42, further comprising: 

prioritizing the one or more relationships, wherein the prioritizing is based on user 
defined logic and values; and 

generating one or more alerts based on one or more of the prioritized relationships. 

64. (New) The method of claim 42, wherein 

determining whether one or more relationships exist comprises prioritizing the 
determined relationships; and 

generating an alert comprises generation an alert only if a relationship having a 
predetermined priority is identified. 

65. (New) The method of claim 42, further comprising: 

identifying any accounts associated with the determined transactions and entities that 
meet a set of user-defined criteria; 

generating an alert informing the user of the identified accounts. 
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66. (New) The method of claim 42, further comprising: 

identifying one or more accounts that meet a set of user-defined criteria for a current 
month but that did not meet the set of user-defined criteria for a previous month, wherein the 
accounts are associated with the determined transactions and entities; 

generating an alert comprising the identified accounts. 

67. (New) The method of claim 42, further comprising: 
identifying a household, having a plurality of associated accounts, 
wherein the household meets a set of user-defined criteria, 

wherein the household is associated with one or more of the determined transactions and 
entities; 

wherein none of the associated accounts individually meet the set of user-defined criteria; 

and 

generating an alert comprising the identified household. 

68. (New) The method of claim 42, further comprising: 

identifying a first set of households, wherein each household is associated with one or 
more accounts, wherein each household meets a set of user-defined criteria, wherein none of the 
accounts associated with the household individually meet the set of user-defined criteria, wherein 
each household in the first set is associated with one or more of the determined transactions and 
entities; and 
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identifying from the first set of households, a second set of households comprising 
households that did not meet the set of user-defined criteria in a previous month. 

69. (New) The method of claim 42, wherein generating an alert comprises: 

providing one or more alert visualizations associated with the transactions and the entities 
that exhibit the common elements to a user. 

70. (New) The method of claim 42, further comprising: 
assigning a score to the determined relationships; 

determining an alert value associated with the alert based on the assigned score; and 
if the alert value is below a threshold value, automatically closing the alert. 

7 1 . (New) A computer program embodied on a computer readable medium for identifying a 
situation representing risk to a brokerage or its investors, wherein the program comprises one or 
more sequences of instructions that cause one or more processors to perform the steps of: 

receiving data from at least one source, wherein the received data comprises a plurality of 
transactions relating to securities trading and a plurality of entities involved in securities trading, 
wherein the plurality of transactions and the plurality of entities are not predetermined to be 
related; 

accessing a scenario library to identify a detection algorithm for identifying a behavior of 
interest indicative of a risk to a brokerage or its investors; 
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applying the detection algorithm to identify common elements between a plurality of the 
transactions and a plurality of the entities in the received data to determine whether the common 
elements are collectively indicative of the behavior of interest; 

determining whether one or more relationships exist among the transactions and the 
entities that exhibit the common element; and 

if so, generating an alert informing a user of the related transactions and entities that 
exhibit the common elements. 

72. (New) The computer program of claim 7 1 , wherein the instructions further cause the one 
or more processors to perform one or more of the following on the plurality of transactions and 
the plurality of entities: 

sequence matching to identify sequences in one or more transactions and to relate the 
identified sequences to one or more of the entities in the received data; 

link analysis to establish connections between one or more transactions and entities in the 
received data; 

rule-based analysis to identify at least one of the transactions and entities based on rules 
specifying parameters and thresholds; 

outlier detection analysis to identify at least one of the transactions and entities outside of 
a defined statistical range; 

decision tree analysis; and 

detection processing using neural networks. 
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